Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 1 of 10 PageID 117

Transcription

1 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 1 of 10 PageID 117 RICHARD FAIRCLOTH, Plaintiff, IN THE UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF FLORIDA ORLANDO DIVISION v. CASE NO.: 6:13-cv TBS ADVENTIST HEALTH SYSTEM/ SUNBELT, INC. Defendant. / FLORIDA HOSPITAL S MOTION TO DISMISS CLASS ACTION COMPLAINT FOR LACK OF SUBJECT MATTER JURISDICTION AND REQUEST FOR ORAL ARGUMENT Defendant, Adventist Health System/Sunbelt, Inc. ( Florida Hospital ), pursuant to Rule 12(b)(1), Federal Rules of Civil Procedure, respectfully requests this Court dismiss the Class Action Complaint filed by Plaintiff, Richard Faircloth, because this Court lacks subject matter jurisdiction, and in support, states: I. Summary of Argument This Court has no jurisdiction to hear a putative class action grounded in alleged violations of the Health Insurance Portability and Accountability Act ( HIPAA ) because no private right of action exists under HIPAA. Mr. Faircloth cannot establish federal question jurisdiction through a statute that provides no private cause of action. Furthermore, Mr. Faircloth s assertion that his state law claims turn on a substantial issue of federal law is misplaced. No federal court has ever found that an alleged HIPAA violation provides jurisdiction over breach of contract and breach of fiduciary common law claims. Accordingly, Florida Hospital respectfully requests this Court dismiss this matter for lack of subject matter jurisdiction.

2 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 2 of 10 PageID 118 II. Background 1 Florida Hospital is a health care provider, with 22 locations 2 throughout Florida. (Doc. 1 at 2). Mr. Faircloth is a former patient at Florida Hospital s Apopka campus, where he received knee treatment on January 25, (Id. at 43). Mr. Faircloth paid Florida Hospital $4,000 for his medical care. (Id. at 45). 3 He intended a portion of this payment to fund security procedures to protect his HIPAA-protected health information, including his social security number and medical history. (Id. at 44-45). In August 2011, Florida Hospital learned that several of its emergency room intake employees were improperly accessing patient data and selling the information to outside parties. (Id. at 6, 27). Florida Hospital had fired one of these employees, Dale Munroe, for an unrelated data breach in July (Id. at 25). It fired Katrina Munroe Mr. Munroe s wife a month later upon discovering the scheme upon which Mr. Faircloth bases his complaint. (Id. at 1 Because this motion presents a facial challenge to subject matter jurisdiction, Florida Hospital must accept Mr. Faircloth s allegations as true. See, e.g., Lawrence v. Dunbar, 919 F.2d 1525, (11th Cir. 1990); Rodriguez-Rivera v. United States, No. 8:12-cv-856-T-30TBM, 2012 WL , *3 (M.D. Fla. Oct. 24, 2012). Florida Hospital respectfully submits, however, that many of Mr. Faircloth s allegations are false or incomplete. It reserves all rights to address these issues should the opportunity arise. 2 While many (perhaps all) of the entities listed in the caption of Plaintiff s Class Action Complaint are indeed d/b/a names for Adventist Health System/Sunbelt, Inc., with the exception of Florida Hospital which is defined at the beginning of this motion none are alleged to be involved in the activity described in Mr. Faircloth s Complaint. Indeed, none were. At the appropriate time, Florida Hospital will work with Mr. Faircloth to clarify this matter s caption, but this is unnecessary for resolution of this motion because Mr. Faircloth has named the correct legal corporation at issue as Adventist Health System/Sunbelt, Inc. 3 The Complaint does not disclose whether Mr. Faircloth was self-insured, or whether this sum was in excess of that paid by his insurer. It is difficult to reconcile Mr. Faircloth s assertion that his claims are typical of the 763,000 Florida Hospital patients comprising the putative class if he is self-insured. By contrast, if Mr. Faircloth has insurance coverage, this allegation raises serious questions regarding his standing to assert a personal damage claim. 2

3 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 3 of 10 PageID ). Over a two-year period, the Munroes had accessed over 763,000 4 Florida Hospital patient records and sold some of the information contained therein to outside lawyer services and chiropractors. (Id. at 23-24). Mr. and Mrs. Munroe sold information relating to certain Florida Hospital patients who had suffered automobile accidents to Sergei Kusyakov, the operator of a chiropractic clinic. 5 (Kusyakov Doc. 47 at 5-6). Pursuant to the arrangement between Mr. Kusyakov and Mr. Munroe, Mr. Munroe accessed Florida Hospital s computer records to search for patients involved in motor vehicle accidents from January 2009 until his termination in July (Kusyakov Doc. 47 at 6; D. Munroe Doc. 28 at 18, 21). Mrs. Munroe took over her husband s role in the criminal conspiracy following his termination. (K. Munroe Doc. 3 at 218). Mr. and Mrs. Munroe accessed patient records even though they were aware of Florida Hospital s policies regarding HIPAA compliance and patient data security. (D. Munroe Doc. 28 at 19; K. Munroe Doc. 3 at 19). 4 The Class Action Complaint varies in its allegations of how many patient records the Munroes accessed. Compare Doc. 1 at 6 (asserting access to 740,000 patients information) with 24 (asserting access to 763,000 patients sensitive information) with 66 (asserting access to 736,000 patients sensitive information). Regardless of how many records the Munroes improperly accessed, the Complaint is silent as to how many patients information was actually released. Indeed, Mr. Faircloth does not contend that his information was released, or that anybody improperly contacted him after his discharge. 5 The information contained in the four following paragraphs comes from the plea agreements entered into by Sergei Kusyakov, Dale Munroe and Katrina Munroe under penalties of perjury. See United States v. Sergei Kusyakov, Case No. 6:12-cr-263-Orl-37DAB, Doc. 47 (referencing plea agreement entered at hearing); United States v. Dale Munroe II, 6:12-cr-215-Orl-37GJK, Doc. 28; United States v. Katrina Munroe, 6:12-cr-305-Orl-37KRS, Doc. 3. In resolving this motion to dismiss, this Court may take judicial notice of the Kusyakov and Munroe criminal matters adjudicated or pending in this district. See Fed. R. Evid. 201(b)(1); In re ING Groep, N.V. Erisa Litig., 749 F. Supp. 2d 1338, 1343 (N.D. Ga. 2010) ( When deciding a motion to dismiss, the Court must limit its consideration to well-pleaded factual allegations, judicially noticed matters, and documents central to or referred to in the complaint. ); Universal Express, Inc. v. U.S. S.E.C., 177 Fed. Appx. 52, 53 (11th Cir. 2006) ( A district court may take judicial notice of certain facts without converting a motion to dismiss into a motion for summary judgment. ). It appears Mr. Faircloth consulted the criminal dockets in preparing his complaint. Compare Munroe Doc. 28 at 20 ( a typical employee accessed approximately 12,100 patient records utilizing the RS23 screen during that same time period. By contrast, Munroe accessed over 763,000 patient records.... ) with Doc. 1 at

4 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 4 of 10 PageID 120 Mr. and Mrs. Munroe accessed a screen in Florida Hospital s computer system called RS23, which allowed them to view 10 patient records quickly and simultaneously. (D. Munroe Doc. 28 at 20; K. Munroe Doc. 3 at 19-20). In this manner, they could easily identify patients involved in motor vehicle accidents. (Id). Mr. and Mrs. Munroe viewed the vast majority of patient records for less than one second while they scrolled through RS23 screens looking for these particular types of patients. (Id). Florida Hospital determined that Mr. and Mrs. Munroe illegally accessed approximately 12,000 patient records in this manner. (D. Monroe Doc. 28 at 21); (K. Munroe Doc. 3 at 21); (Kusyakov Doc. 47 at 5). Following discharge, some of these former patients received a telephone call from someone offering a lawyer or chiropractor referral. (Kusyakov Doc. 47 at 6). The caller attempted to refer them to Mr. Kusyakov s chiropractic clinic, which also had a practice of staging false vehicle accidents to create patients whose insurance companies Mr. Kusyakov could bill for the resulting chiropractic treatments the clinic administered. (Id. at 6-7). Mr. Kusyakov paid Mr. and Mrs. Munroe over $10,000 for this information. (Id. at 9); (D. Munroe Doc. 28 at 25); (K. Munroe Doc. 3 at 23). Mr. Kusyakov recently pled guilty to four counts of violating HIPAA and one count of conspiracy to commit an offense against the United States. (Kusyakov Doc. 52 at 1). He has been sentenced to 48 months in prison. (Id. at 2). Mr. Munroe recently pled guilty to one count of violating HIPAA and one count of conspiracy to commit an offense against the United States. (D. Munroe Doc. 32 at 1). He has been sentenced to one year and one day in prison. (Id. at 2). Mrs. Munroe recently pled guilty to one count of conspiracy to commit an offense against the United States. (K. Munroe Doc. 3 at 1). She awaits sentencing. (K. Munroe Doc. 21). 4

5 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 5 of 10 PageID 121 Mr. Faircloth accuses Florida Hospital of also violating HIPAA and its regulations. (Doc. 1 at 34-38). He contends that even though Florida Hospital patients both expected and paid for HIPAA-compliant security measures, the hospital system failed to implement protocols that could have precluded the unauthorized access of patient data. (Id. at 42). Mr. Faircloth suggests that he is an adequate class representative of the at least 763,000 members of the Class throughout the country, and that his experiences were typical of his fellow putative class members. (Id. at 51-52). Although alleged HIPAA violations provide the sole asserted basis for federal subject matter jurisdiction, Mr. Faircloth alleges four causes of action against Florida Hospital grounded in state common law: breach of contract, breach of implied contract (alternative relief), restitution/unjust enrichment (alternative relief) and breach of fiduciary duty. (Id. at 11, 70-95). He seeks class certification, injunctive relief, monetary damages and attorneys fees and costs. (Id. at 26). Mr. Faircloth is not entitled to any relief in this venue, however, because this Court lacks subject matter jurisdiction. III. Legal Standard This Court is of limited jurisdiction, empowered only to hear cases within the judicial power of the United States, as defined by the Constitution. See Bochese v. Town of Ponce Inlet, 405 F.3d 964, (11th Cir. 2005). This Court should inquire into whether it has subject matter jurisdiction at the earliest possible stage in the proceedings. See id. Mr. Faircloth bears the burden of establishing the existence of subject matter jurisdiction, and he cannot meet this burden. See Sweet Pea Marine, Ltd., v. APJ Marine, Inc., 411 F.3d 1242, 1248 fn. 2 (11th Cir. 2005). 5

6 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 6 of 10 PageID 122 Rule 12(b)(1) provides two different bases to address whether Mr. Faircloth s claims give rise to federal subject matter jurisdiction. See Lawrence v. Dunbar, 919 F.2d 1525, (11th Cir. 1990); Rodriguez-Rivera v. United States, No. 8:12-cv-856-T-30TBM, 2012 WL , *3 (M.D. Fla. Oct. 24, 2012). If Florida Hospital presents a facial challenge to federal subject matter jurisdiction, then this Court will accept Mr. Faircloth s allegations as true. See Lawrence, 919 F.2d at If Florida Hospital advances a factual attack, however, then this Court can consider matters outside the pleadings like testimony or affidavits. See id. Based solely on the face of his complaint, Mr. Faircloth cannot establish federal subject matter jurisdiction. IV. Legal Analysis This Court lacks subject matter jurisdiction because neither Mr. Faircloth nor any of the other alleged 763,000 similarly-situated putative class members have a private right of action under HIPAA. Mr. Faircloth anchors his claim of federal jurisdiction on HIPAA: The Court has jurisdiction over this action pursuant to 28 U.S.C and 1367 because Plaintiff s state law claims turn on substantial questions of Federal Law, specifically whether Florida Hospital violated HIPAA and its associated regulations.... (Doc. 1 at 11). Without a private right of action, however, federal jurisdiction only exists if this matter turns on a substantial, disputed question involving the interpretation of HIPAA. It does not, and no federal court has ever ruled otherwise. In the absence of federal question jurisdiction, Florida Hospital respectfully requests that this Court dismiss Mr. Faircloth s lawsuit. A. HIPAA Does Not Contain a Private Right of Action. Mr. Faircloth has no private right of action under HIPAA. See Crawford v. City of Tampa, 397 Fed. Appx. 621, 623 (11th Cir. 2010) ( we agree that no private right of action 6

7 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 7 of 10 PageID 123 exists under the Health Insurance Portability and Accountability Act. ); Smiley v. Alabama Dept. of Transp., 778 F. Supp. 2d 1283, 1301 (M.D. Ala. 2011) ( [h]owever, HIPAA regulations do not expressly or implicitly confer a private right of action on an individual. ); Miller v. Harden, 2006 WL (M.D. Fla. 2006). Absent one exception, Mr. Faircloth cannot establish federal subject matter jurisdiction without a private right of action. See Thompson-El v. Bank of Am., N.A., 1:12-CV-840-TWT, 2012 WL (N.D. Ga. 2012) (citing Jairath v. Dyer, 154 F.3d 1280, (11th Cir. 1998); See Reynolds ex rel. Estate of Porter v. Con-Way Transp. Services, Inc., 15 Fla. L. Weekly Fed. D 490 (M.D. Fla. 2002). This exception does not apply to Mr. Faircloth. B. This Matter Does Not Turn on Substantial Questions of Federal Law. Contrary to Mr. Faircloth s assertions, his matter does not involve a substantial, disputed question of federal law. City of Huntsville v. City of Madison, 24 F.3d 169, 172 (11th Cir. 1994); (Doc. 1 at 11) (stating that Plaintiff s state law claims turn on substantial questions of Federal Law, specifically whether Florida Hospital violated HIPAA and its associated regulations....). Federal courts have uniformly held that there is no substantial, disputed question of federal law when HIPAA violations are incorporated into alleged violations of state laws. See, e.g., McKnight v. Surgical Associates of Myrtle Beach LLC, Civil Action No. 4:11- cv rbh, 2011 WL at *5 (D.S.C. Nov. 18, 2011) (citing authorities from the Third, Fourth, Fifth, Sixth, Eighth and Ninth Circuits); O'Donnell v. Blue Cross Blue Shield of Wyoming, 173 F. Supp. 2d 1176, 1183 (D. Wyo. 2001) (declining jurisdiction over state-law claims that implicated HIPAA and stating that [t]he mere fact that a state court may look to federal law to aid it in construing a portion of a state cause of action does not turn the state cause 7

8 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 8 of 10 PageID 124 of action into a federal question or cause of action. ). Stated differently, no federal court has ever found subject matter jurisdiction on the grounds Mr. Faircloth demands it. 6 Generally, the mere presence of a federal issue in a common-law cause of action does not confer federal subject matter jurisdiction. Dunlap v. G&L Holding Group, Inc., 381 F.3d 1285, 1290 (11th Cir. 2004). In order for a state law claim to raise a substantial question, federal law must therefore be an essential element of the state law claim. Id. (citing Moore v. News Corp., Case No. 6:09-cv-2182-Orl-31DAB, 2009 WL at *1 (M.D. Fla. Dec. 30, 2009) (Presnell, J.)). Furthermore, the federal right supposedly forming the basis of the state law claim must be such that the claim is supported if federal law is given one construction or effect and defeated if it is given another. Moore, 2009 WL at *1. A statutory construction of HIPAA will not determine whether Mr. Faircloth s common law claims succeed or fail. HIPAA does not determine whether Mr. Faircloth entered into a contract with Florida Hospital or whether Florida Hospital breached that contract. HIPAA does not create the existence of a fiduciary duty between Mr. Faircloth and Florida Hospital. And HIPAA does not determine what damages, if any, Mr. Faircloth may have suffered. Indeed, Mr. Faircloth s claims for breach of contract and breach of fiduciary duty sweep far more broadly than any alleged federal statutory violation. See Baron v. Osman, 39 So. 3d 449, 450 (Fla. 5th DCA 2010) (reciting elements for breach of contract); Cruselle v. Mong, 59 So. 3d 1178, 1181 (Fla. 5th DCA 2011) (reciting elements for breach of fiduciary duty). He peppers his state-law 6 Courts in the First and Second Circuits have not reached the issue of whether HIPAA implicates a substantial, disputed question of federal law as to give rise to federal question jurisdiction. Rather, these Circuits do not reach the issue after concluding that HIPAA does not provide a private right of action and thus provides no basis for federal question jurisdiction. See Hill v. New York Post, 08 CIV 5777(PAC)(FM), 2010 WL at *3 (S.D.N.Y. May 28, 2010); Valentin Munoz v. Island Fin. Corp., 364 F. Supp. 2d 131, 136 (D.P.R. 2005). 8

9 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 9 of 10 PageID 125 claims against Florida Hospital with references to state law, industry standards, and generalized privacy protections. (Doc. 1 at 59, 62, 68). But no matter how many times he specifically references HIPAA in connection with alleged breaches, Mr. Faircloth cannot conjure federal jurisdiction where none exists. His subjective interpretation of a federal statute as a necessary element of what would otherwise be a state contract claim is not enough to permit exercise of federal question jurisdiction. See City of Huntsville, 24 F.3d at 170 (no jurisdiction where plaintiff insisted that the interpretation of a federal statute without a private right of action was pivotal to a dispute with defendant). Therefore, regardless of whether Mr. Faircloth relies on general case law describing when a substantial, disputed issue of federal law arises, or specific case law applying to HIPAAconnected state law claims, he cannot establish a basis for federal question jurisdiction. V. Request for Oral Argument Pursuant to Local Rule 3.01(j), Florida Hospital respectfully requests oral argument on the issues raised in this motion. It anticipates 30 minutes will be required for hearing. VI. Conclusion This Court lacks subject matter jurisdiction to hear this dispute. For the foregoing reasons, Florida Hospital respectfully requests that this Court dismiss the Complaint, and enter any further relief it deems necessary and just. Respectfully submitted this 2nd day of May, 2013, /s/ Mayanne Downs Mayanne Downs Florida Bar No.: mayanne.downs@gray-robinson.com Daniel E. Traver Florida Bar No.: daniel.traver@gray-robinson.com GrayRobinson, P.A. 9

10 Case 6:13-cv RBD-TBS Document 13 Filed 05/02/13 Page 10 of 10 PageID East Pine Street, Suite 1400 P.O. Box 3068 Orlando, FL Telephone: (407) Facsimile: (407) Attorneys for Defendant, Adventist Health System/Sunbelt, Inc. CERTIFICATE OF SERVICE I HEREBY CERTIFY that a copy of this Motion has been served by electronic mail on all parties and counsel identified on the CM/ECF service list created and maintained by the Court for this case, on May 2, _/s/ Mayanne Downs Mayanne Downs 10